From 07adf6c290bd3516eb0d7873959204b6b79af915 Mon Sep 17 00:00:00 2001
From: "timeless%mozdev.org"
 <timeless%mozdev.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Sun, 23 Nov 2003 14:01:43 +0000
Subject: [PATCH] Bug 223736 nsWebShellWindow::Destroy should call
 nsWebShellWindow::Destroy before destroying its timer and calling
 release_this r=danm sr=dbaron a=dbaron

git-svn-id: svn://10.0.0.236/trunk@149652 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../xpfe/appshell/src/nsWebShellWindow.cpp    | 22 ++++++++++++++-----
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp b/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp
index d38f911c533..84e281b2114 100644
--- a/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp
+++ b/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp
@@ -210,11 +210,13 @@ nsWebShellWindow::~nsWebShellWindow()
     mWindow->SetClientData(0);
   mWindow = nsnull; // Force release here.
 
-  PR_Lock(mSPTimerLock);
-  if (mSPTimer)
-    mSPTimer->Cancel();
-  PR_Unlock(mSPTimerLock);
-  PR_DestroyLock(mSPTimerLock);
+  if (mSPTimerLock) {
+    PR_Lock(mSPTimerLock);
+    if (mSPTimer)
+      mSPTimer->Cancel();
+    PR_Unlock(mSPTimerLock);
+    PR_DestroyLock(mSPTimerLock);
+  }
 }
 
 NS_IMPL_THREADSAFE_ADDREF(nsWebShellWindow)
@@ -1174,6 +1176,9 @@ nsWebShellWindow::DestroyModalDialogEvent(PLEvent *aEvent)
 void
 nsWebShellWindow::SetPersistenceTimer(PRUint32 aDirtyFlags)
 {
+  if (!mSPTimerLock)
+    return;
+
   PR_Lock(mSPTimerLock);
   if (mSPTimer) {
     mSPTimer->SetDelay(SIZE_PERSISTENCE_TIMEOUT);
@@ -1195,6 +1200,8 @@ void
 nsWebShellWindow::FirePersistenceTimer(nsITimer *aTimer, void *aClosure)
 {
   nsWebShellWindow *win = NS_STATIC_CAST(nsWebShellWindow *, aClosure);
+  if (!win->mSPTimerLock)
+    return;
   PR_Lock(win->mSPTimerLock);
   win->SavePersistentAttributes();
   PR_Unlock(win->mSPTimerLock);
@@ -1654,14 +1661,17 @@ NS_IMETHODIMP nsWebShellWindow::Destroy()
    }
 #endif
 
+  nsCOMPtr<nsIWebShellWindow> kungFuDeathGrip(this);
   PR_Lock(mSPTimerLock);
   if (mSPTimer) {
     mSPTimer->Cancel();
-    mSPTimer = nsnull;
     SavePersistentAttributes();
+    mSPTimer = nsnull;
     NS_RELEASE_THIS(); // the timer held a reference to us
   }
   PR_Unlock(mSPTimerLock);
+  PR_DestroyLock(mSPTimerLock);
+  mSPTimerLock = nsnull;
 
   return nsXULWindow::Destroy();
 }